CVE-2026-41472: medium-severity vulnerability in usmannasir cyberpanel
CyberPanel < 2.4.5 Stored XSS via AI Scanner Dashboard
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 5.3epss 0.5%
CyberPanel versions prior to 2.4.5 contain a stored cross-site scripting vulnerability in the AI Scanner dashboard where the POST /api/ai-scanner/callback endpoint lacks authentication and allows unauthenticated attackers to inject malicious JavaScript by overwriting the findings_json field of ScanHistory records. Attackers can inject JavaScript that executes in an administrator's authenticated session when they visit the AI Scanner dashboard, allowing them to issue same-origin requests to plant cron jobs and achieve remote code execution on the server.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
Affected products
usmannasir · cyberpanelpublic PoCs found — 1
cve_referenceitsrez.re/post/cyberpanel-rceunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — usmannasir cyberpanel
In the same product, most dangerous first.
CVE-2026-71966HIGHCyberPanel 2.4.3 Authenticated Command Injection via starRemoteTransferEPSS 3.3%CVE-2026-67614CRITICALCyberPanel < 3.0.0 Hard-coded JWT Secret Authentication Bypass via WebTerminalEPSS 1.0%CVE-2026-87820MEDIUMCyberPanel 2.4.3 through 2.4.5 Information Disclosure via AI ScannerEPSS 0.9%CVE-2026-41473HIGHCyberPanel < 2.4.5 Unauthenticated API Access via AI Scanner EndpointsEPSS 0.8%CVE-2026-88895HIGHCyberPanel before 3.0.5 Authentication Bypass via APIEPSS 0.7%CVE-2026-65917HIGHCyberPanel IncBackups IDOR via Sequential Backup IDEPSS 0.5%